7 ms·

Have you considered that your service, unbeknownst to you, may have been compromised at some point in time, and the source of some phishing page or other malici

by phrz 4y ago

Have you considered that your service, unbeknownst to you, may have been compromised at some point in time, and the source of some phishing page or other malicious material? Besides that possibility, if your business is truly being "destroyed," have you contemplated retaining counsel to escalate things with Microsoft?

marcosdumay 4y ago
Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material? And yes, that is a major defamation campaign led by Microsoft against the OP. And since MS even refuses to clarify their claim about the OP's wrongdoing, I imagine he would have an easy time in a court.
- Quarrelsome 4y ago
  > Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material? Ye, it tells bad actors how the detection system works.
  - biorach 4y ago
    No it doesn't. It simply tells that the detection system _has_ worked.
    - ohbtvz 4y ago
      Imagine that MS replies "we detected malware spreading from your site" without any other details. What is OP supposed to do then? Won't they be just as frustrated, if not more, than before?
      - yamtaddle 4y ago
        There is a 0% chance that a site could be spreading malware and there's not a single thing MS could point to to help out the owners find it that wouldn't leak Super Secret Advanced Mega-Genius Malware Detection Methods. They just don't want to because that costs more money than being a huge piece of shit does.
      - bell-cot 4y ago
        Just "we detected malware spreading from your site" would sure narrow things down a lot. Time to inspect the web server access logs, 'diff' the site contents with a month-old backup, etc.
        mrguyorama 4y ago
        They should be doing exactly that anyway.
        bell-cot 4y ago
        Just as all Americans should be driving at no more than the speed limit...
    - Quarrelsome 4y ago
      If they tell you the steps you have to take to get off the shit list then its not hard to reverse engineer how to avoid being on the shit list.
      - iforgotpassword 4y ago
        Yes, that's how it should work.
  - dboreham 4y ago
    The Catch-22 enabling "corporate responsibility shirking".
  - counttheforks 4y ago
  - marcosdumay 4y ago
    Yeah, I don't buy this one. "Your site is participating in a phishing campaign, here is an example: $URL" doesn't tell a malicious party anything they didn't already know from the original MS warning. In fact, I'll go further. MS owns we an explanation why they are warning on any random site. Not only the site's owner.
  - yamtaddle 4y ago
    This is why well-regarded justice systems don't disclose anything about why they arrested someone and are jailing them indefinitely. It'd give criminals too much of an edge otherwise, and would surely be unworkable and lead to violent anarchy in short order.
    - scarface74 4y ago
      Surely you don’t consider the US to have a well regarded justice system do you?
      - yamtaddle 4y ago
        This is irrelevant to my post. Would removing all transparency from it help, or make it worse? Are there better-regarded ones that don't reveal anything whatsoever to the accused and convicted, because that'd make it so hard to stop criminals that everything would fall apart? [EDIT] My point is simply that somehow we manage in basically every other space to let those accused of wrongdoing know what we think they did that looked like wrongdoing, but somehow when it's an Internet giant calling the shots that's just impossible and waaaaah too hard and the sky would fall if they ever treated anyone with any amount of humanity and respect. I think it's grade-A bullshit and they've just figured out they can get away with being assholes at scale and no-one will make them stop.
        scarface74 4y ago
        There is no indication that the original poster did any type of security review to make sure that the block was justified. Let’s start there. It’s not just the internet. No company disclosed their fraud detection techniques.
        marcosdumay 4y ago
        The OP sounds like somebody that would do a non-through, not very competent review, and not find anything. But it doesn't matter. MS is the one telling to the entire world that his software is not reliable. They don't get to tell it all over the world without bringing some evidence.
ryandrake 4y ago
Yea, the first thing I would do is rigorously determine whether the problem is actually a false positive (note: not a "false flag" which is something entirely different). Seems a bit early to jump straight to "it must be a competitor."
m3047 4y ago
This. Also: magecart for TTPs. OTOH it might not be. LinkedIn flagged a domain I own as malware and pointed fingers at Spamhaus. Spamhaus had it flagged, but removed the flag when I objected. Their management claimed sites which they flag did something to deserve it on LinkedIn, but never said what. (There is no malware. It's just cranky, especially to bots.) I doubt that Spamhaus' intent was that someone should publicly mark it as malware for other parties though.

by phrz 4y ago

marcosdumay 4y ago

Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material? And yes, that is a major defamation campaign led by Microsoft against the OP. And since MS even refuses to clarify their claim about the OP's wrongdoing, I imagine he would have an easy time in a court.

Quarrelsome 4y ago
> Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material? Ye, it tells bad actors how the detection system works.
- biorach 4y ago
  No it doesn't. It simply tells that the detection system _has_ worked.
  - ohbtvz 4y ago
    Imagine that MS replies "we detected malware spreading from your site" without any other details. What is OP supposed to do then? Won't they be just as frustrated, if not more, than before?
    - yamtaddle 4y ago
      There is a 0% chance that a site could be spreading malware and there's not a single thing MS could point to to help out the owners find it that wouldn't leak Super Secret Advanced Mega-Genius Malware Detection Methods. They just don't want to because that costs more money than being a huge piece of shit does.
    - bell-cot 4y ago
      Just "we detected malware spreading from your site" would sure narrow things down a lot. Time to inspect the web server access logs, 'diff' the site contents with a month-old backup, etc.
      - mrguyorama 4y ago
        They should be doing exactly that anyway.
        bell-cot 4y ago
        Just as all Americans should be driving at no more than the speed limit...
  - Quarrelsome 4y ago
    If they tell you the steps you have to take to get off the shit list then its not hard to reverse engineer how to avoid being on the shit list.
    - iforgotpassword 4y ago
      Yes, that's how it should work.
- dboreham 4y ago
  The Catch-22 enabling "corporate responsibility shirking".
- counttheforks 4y ago
- marcosdumay 4y ago
  Yeah, I don't buy this one. "Your site is participating in a phishing campaign, here is an example: $URL" doesn't tell a malicious party anything they didn't already know from the original MS warning. In fact, I'll go further. MS owns we an explanation why they are warning on any random site. Not only the site's owner.
- yamtaddle 4y ago
  This is why well-regarded justice systems don't disclose anything about why they arrested someone and are jailing them indefinitely. It'd give criminals too much of an edge otherwise, and would surely be unworkable and lead to violent anarchy in short order.
  - scarface74 4y ago
    Surely you don’t consider the US to have a well regarded justice system do you?
    - yamtaddle 4y ago
      This is irrelevant to my post. Would removing all transparency from it help, or make it worse? Are there better-regarded ones that don't reveal anything whatsoever to the accused and convicted, because that'd make it so hard to stop criminals that everything would fall apart? [EDIT] My point is simply that somehow we manage in basically every other space to let those accused of wrongdoing know what we think they did that looked like wrongdoing, but somehow when it's an Internet giant calling the shots that's just impossible and waaaaah too hard and the sky would fall if they ever treated anyone with any amount of humanity and respect. I think it's grade-A bullshit and they've just figured out they can get away with being assholes at scale and no-one will make them stop.
      - scarface74 4y ago
        There is no indication that the original poster did any type of security review to make sure that the block was justified. Let’s start there. It’s not just the internet. No company disclosed their fraud detection techniques.
        marcosdumay 4y ago
        The OP sounds like somebody that would do a non-through, not very competent review, and not find anything. But it doesn't matter. MS is the one telling to the entire world that his software is not reliable. They don't get to tell it all over the world without bringing some evidence.

ryandrake 4y ago

Yea, the first thing I would do is rigorously determine whether the problem is actually a false positive (note: not a "false flag" which is something entirely different). Seems a bit early to jump straight to "it must be a competitor."

m3047 4y ago

This. Also: magecart for TTPs. OTOH it might not be. LinkedIn flagged a domain I own as malware and pointed fingers at Spamhaus. Spamhaus had it flagged, but removed the flag when I objected. Their management claimed sites which they flag did something to deserve it on LinkedIn, but never said what. (There is no malware. It's just cranky, especially to bots.) I doubt that Spamhaus' intent was that someone should publicly mark it as malware for other parties though.